Can you, as a thirsty passenger, take some water with you anyways? Leave your answer in a comment. The comments will stay private for a while, and be published later in the next blog post.. Try to solve it, and then look at the solutions in the comments below!

Update: comments were briefly not moderated, already showing the solution immediately; sorry for that.
Update: Let’s try to do it differently from the other puzzles then! Only look at the comments below after you’re tried to solve it yourself!

This one is not so hard. The trick is that the ArrayList constructor calls toArray() on the original collection and uses that result as a backing array. With some simple code, we can get hold of that array and modify it after the security check.

All you need is a class implementing the Collection interface whose return value of toArray() is under your control. For shortness I used ArrayList as a base class instead of implementing all the methods of the Collection interface myself.

I erred on the complicated side I guess, as I completely defined a dirty implementation of the Collection interface. The tricky bit was that toArray must return an Object[], not a String[], for the ArrayList constructor to use it.

My first attempt… hide the data in secret compartment, then after the security checkpoint, hijack and innocently looking method to add it back to the luggage. But, the Luggage.class defeats this by wrapping my collection.

I prepared this as a separate blog-post, but given my missing-moderation-fluke (or is it actually better this way?), I’ll just add it here as a comment:

For those breaking their head over it: the for-loop, the Collection.contains and String.contains were just distractions to avoid making it too easy. Collections.unmodifiableCollection is also still perfectly safe.
The hole is in the ArrayList constructor. It’s implemented like this (in JDK 6 and 7):

There’s a check if the array returned from c.toArray() is of the right type. But nothing makes sure c doesn’t still hold a reference to that array. So the ArrayList can still be modified from the inside by modifying the array directly.

We create some perfectly safe luggage, and then teleport our water in: